Well, Microsoft may have super-vetted Mike Hanson, but apparently the vetting of others ain’t perfect.
The code signing has never been a solid protection, more of an expensive way to show that the developer thinks the software is protected, while making a TON of money for the companies that sell those certificates. And indeed it was bound to become public - I’m sure this has been done for years by unscrupulous cybercriminals.